Document 376700.1 PDF
Document 376700.1 PDF
1 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
Section 1: Introduction
The most significant change for Secure Sockets Layer (SSL) support in Oracle E-Business Suite Release 12 is the use of the mod_ossl
module for the Oracle HTTP Server. Like mod_ssl, the mod_ossl plug-in enables strong cryptography for Oracle HTTP Server. In contrast to
the OpenSSL module, mod_ossl is based on the Oracle implementation of SSL, which supports SSL and TLS protocols, and is based on
Certicom and RSA Security technology.
In Oracle E-Business Suite Release 12 SSL certificates will be managed by Oracle Wallet Manager 10g, which will be accessible via the
familiar OWM graphical user interface (GUI) or the new ORAPKI command line interface (CLI). Since Oracle E-Business Suite Release 12
uses the Forms Listener Servlet, a separate certificate is no longer needed for Forms as it will share the same wallet as the Oracle HTTP
Server.
In keeping with the theme of security, and as part of implementing SSL, it is recommended that you also review your current JRE
deployment, as well as looking into enhanced JAR file signing. Refer to document 393931.1 for information on obtaining the most current
JRE, and document 1591073.1 for information on signing JAR files.
Note: Use of the Forms Server Listener with ConnectMode=https is not supported. ConnectMode=https only works with JInitiator,
which includes the Oracle SSL libraries. Release 12 uses the Sun Java Plugin. If you need to use https for the Forms communication
layer you must use the servlet architecture.
3/07/2016 12:52 p. m.
Document 376700.1
2 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
User certificates - issued to servers or users to prove their identity in a public key/private key exchange.
Trusted certificates - representing entities who you trust, such as certificate authorities.
3/07/2016 12:52 p. m.
Document 376700.1
3 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
table - Changes when using an SSL Accelerator. Please make certain that the SSL certificate used on the SSL Accelerator is in place.
Consult the documentation for your SSL Accelerator as needed. If you are also enabling SSL at the Oracle E-Business Suite level in addition
to the SSL Accelerator, then all steps in Section 3 would still apply.
If you are making use of a self-signed, in-house, or trial certificate and the root CA or any intermediate certificate component is not found in
the certificate chain, errors may be encountered. In this case, you would need to follow all the steps in Section 3, starting with step 5. In
addition, you may also need to import the root CA into the client side JRE trust store.
Windows -> Control Panel -> Programs -> Java -> Security (tab) -> Manage Certificates
From here you can import Trusted Certificates as well as Signer CA certificates. Depending on the type of certificate, you may also need to
import the same certificate components into the client side browser.
Note: If you plan to use "cookie based session persistence" at the HTTP Load Balancer level, and you plan to enable SSL for HTTP
traffic at all application tier Web Nodes, you have to use a SSL Accelerator as the Web Entry Point Host. This is because HTTP Load
Balancers cannot intercept the SSL encrypted communication between the Client Browser and the application tier Web Server to insert
or delete cookies to maintain session persistence. It is advantageous to use SSL accelerators because it requires less maintenance as
none of the application tier Web Nodes have to be configured for SSL.
Inbound Encryption
This involves connections from a client to the Oracle HTTP Server (OHS) delivered with the Oracle E-Business Suite applications Technology
stack. With inbound connections, the SHA (can be SHA-1 or SHA-2) signed PKI certificate is requested from a CA by your company for your
Oracle E-Business Suite OHS.
Examples include, but are not limited to the following:
- User accesses Oracle E-Business Suite applications pages via the network using a browser.
- User accesses Oracle E-Business Suite application via Oracle Forms when using Forms Servlet mode.
- An XML Gateway message originating from a customer is sent to Oracle E-Business Suite.
- A mobile phone communicates with the E-Business Suite via a REST service.
Outbound Encryption
This involves connections from Oracle E-Business Suite to external site(s). For outbound connections, the SHA (can be SHA-1 or SHA-2)
signed PKI certificate is requested from a CA by a site you are connecting to from Oracle E-Business Suite. For this case, Oracle E-Business
Suite is acting as an HTTPS client. You must trust the root CA of the remote server's certificate chain in your truststore.
Example include, but are not limited to the following:
- Punchout in iProcurement.
- XML Gateway connection to a partner applications.
- Payments credit card processing.
- Dunn & Bradstreet (HZ).
- International Trade Management (ITM) for screening orders and deliveries.
- CIS Tax Module
Loopback Connection
This involves connections from Oracle E-Business Suite back to the Oracle HTTP Server (OHS) delivered with the Oracle E-Business Suite
applications technology stack. For loopback connections, the SHA (can be SHA-1 or SHA-2) signed PKI certificate is requested from a CA by
your company for your Oracle E-Business Suite OHS.
Examples include, but are not limited to the following:
- Workflow notification emails from the Concurrent Manager tier.
- Payments call back from the Database tier.
- Oracle Process Manager (OPMN).
- Oracle Applications Manager Log Viewer.
3/07/2016 12:52 p. m.
Document 376700.1
4 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
These instructions involve the use of the Oracle Wallet Manager Graphical User Interface. If you would prefer to use the Oracle Wallet
Manager Command Line Interface refer to My Oracle Support Knowledge Document 376694.1: Using the Oracle Wallet Manager Command
Line Interface in Release 12.
If you have unexpired certificates from your Oracle E-Business Suite Release 11i SSL instance you can convert them using the instructions in
Section 6 .
Note: Discoverer users who enable SSL for the E-Business Suite must also enable SSL for Discoverer.
Please refer to the following documents:
- Oracle Application Server Business Intelligence documentation
- For Discoverer without Portal or Single SignOn (SSO) refer to My Oracle Support Knowledge Document 338071.1 - How To Configure
Discoverer 10g (10.1.2) Plus/Viewer For HTTPS (SSL) Access
- For Discoverer with Portal and/or Single SignOn (SSO) refer to My Oracle Support Knowledge Document 339448.1 - Quick Start to
Configure Discoverer Plus/Viewer/Portlet Provider 10.1.2.0.2 in SSL + SSO
3/07/2016 12:52 p. m.
Document 376700.1
5 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
Note: When working with wallets and certificates you must use the 10.1.3 executables.
3/07/2016 12:52 p. m.
Document 376700.1
6 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
such cases, you will need to create a CSR signed with a SHA based signature algorithm using another tool. Refer to
Section 9 and Signature Algorithm Changes.
Using the mkwallet command:
Note: When importing or adding SHA-2 signed PKI certificates, mkwallet (not Wallet Manager) is required for HP Itanium and Windows.
1. Execute the mkwallet command
mkwallet -r <wallet password> . "CN=<Your host name of your server including the domain>, OU=<The unit
within your organization>, O=<name of your organization>, L=<your locality or city>, ST=<the full name of
your State or Province - do not abbreviate>, C=<country>" 2048 server-md5.csr
For example:
mkwallet -r <wallet password> . "CN=ebs.example.com, OU=TLS, O=Example Inc, ST=California, C=US" 2048
server-md5.csr
Note: Depending on your certificate provider, they may not accept the MD5 based certificate request (CSR) generated by the Oracle
Wallet Manager (OWM). For example, VeriSign will now only accept SHA-1 2048 bit based CSRs or higher. In such cases, you will need
to create a CSR signed with a SHA based signature algorithm using another tool. Refer to Section 9 and Signature Algorithm Changes.
3/07/2016 12:52 p. m.
Document 376700.1
7 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
After you receive your Server Certificate from your Certifying Authority you will need to import it into your wallet. Copy the
certificate to server.crt in the wallet directory on your server by one of the following methods:
Note: If all trusted certificates that make up the chain of server.crt are not present in the wallet, then adding the
certificate will fail. When the wallet was created, the certificates for the most common CAs (such as VeriSign, GTE, and
Entrust) were included automatically. Contact your certifying authority if you need to add their certificate, and save the
provided file as ca.crt in the wallet directory in a base64 format. Another option is to follow the instructions in Section 7 to
create ca.crt from your server certificate (server.crt). If your Certifying Authority provided an intermediate certificate (to
complete the chain) then save the provided file as intca.crt in a Base64 format, this will need to be imported into Oracle
Wallet Manager prior to importing the server.crt. Certificates that comprise several parts (such as the P7B type) would also
fall into this category.
1. Copy the certificate (in binary mode)
2. copy and paste the contents into server.crt
Follow these steps to import server.crt into your wallet:
1. Open the Wallet Manager as a background process:
$ owm &
If you were also provided an Intermediate Certificate (intca.crt) then you will also need to add that to the
b64InternetCertificate.txt:
$ cat intca.crt >> <10.1.2 ORACLE_HOME>/sysman/config/b64InternetCertificate.txt
NZDST_CLEAR_PTP
NZDST_CLEAR_PTP
NZDST_CERTIFICATE
## root CA cert
## intermediate CA cert
## server cert
3/07/2016 12:52 p. m.
Document 376700.1
8 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
4. Import the root CA certificate as well as the intermediate CA certificate (if applicable) into b64InternetCertificate.txt:
cat ca.crt >> <10.1.2 ORACLE_HOME>/sysman/config/b64InternetCertificate.txt
cat intca.crt >> <10.1.2 ORACLE_HOME>/sysman/config/b64InternetCertificate.txt
If you were also provided an Intermediate Certificate (intca.crt) then you will also need to add that to the cacerts before
adding the server.crt:
$ keytool -import -alias ApacheRootCA -file ca.crt -trustcacerts -v -keystore cacerts
$ keytool -import -alias ApacheIntCA -file intca.crt -trustcacerts -v -keystore cacerts
$ keytool -import -alias ApacheServer -file server.crt -trustcacerts -v -keystore cacerts
Note: Whenever you upgrade your jdk version on the server any additional certificate you added to your cacerts file will be lost. You will
need to re-import the root certificate or keep a copy of your original cacerts file which you can copy back in.
Step 8 - Update the Context File
Use the E-Business Suite - Oracle Applications Manager (OAM) Context Editor to change the SSL related variables as shown in this table:
SSL Related Variables in the Context File
Variable
Non-SSL Value
SSL Value
s_url_protocol
http
https
s_local_url_protocol
http
https
s_webentryurlprotocol
http
https
3/07/2016 12:52 p. m.
Document 376700.1
9 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
s_active_webport
same as s_webport
same as s_webssl_port
s_webssl_port
not applicable
default is 4443
s_https_listen_parameter
not applicable
same as s_webssl_port
s_login_page
s_external_url
Non-SSL Value
SSL Value
s_url_protocol
http
http
s_local_url_protocol
http
http
s_webentryurlprotocol
http
https
s_active_webport
same as s_webport
s_webentryhost
same as s_webhost
s_webentrydomain
same as s_domainname
s_enable_sslterminator
s_login_page
s_external_url
3/07/2016 12:52 p. m.
Document 376700.1
10 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
where:
'[address to access]' = the url for your E-Business Suite Rapid Install Portal.
'[proxy address]' = the url of your proxy server, or NULL if not using a proxy server.
'file:[full path to wallet directory]' = the location of your wallet directory (do not specify the actual wallet files).
The final parameter is the wallet password, which is set to null by default.
Examples:
SQL>select utl_http.request('https://www.oracle.com:4443','http://proxy.com:80', 'file:/d1/oracle/db/tech_st
/10.2.0/appsutil/wallet', null) from dual;
If the wallet has been properly set up, you will be returned the first 2,000 characters of the html page.
Note: Oracle Database 11g Release 2 (11.2) and Oracle Database 12c enables Oracle Real Application Clusters (RAC) nodes to share a
wallet. This eliminates the need to manually copy and synchronize the wallet across all nodes. The wallet can be created on a shared file
system, allowing all instances to access the same shared wallet. If you are not using a shared file system to store the wallet, you need
to copy the wallet to all nodes. This also applies to advanced database security features for which you may already be using a wallet,
such as Transparent Data Encryption.
3/07/2016 12:52 p. m.
Document 376700.1
11 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
1. Self-Signed Certificates
Self-signed certificates are appropriate to use for testing the Advanced SSL configurations. These are sometimes also used for
Advanced SSL Configuration in a production environment where you are effectively your own client. Be sure you understand the
limitations of self-signed certificates when using them in any environment.
2. Certificates signed by the OracleAS Certificate Authority (see Section 8) .
These certificates were designed to be used within your Oracle Application Server environment.
3. Certificates signed by a Certificate Authority such as Verisign, Thawte, etc.
These certificates are appropriate for use in any environment and provide the highest level of security.
Some steps will be slightly different if you are using Self-Signed Certificates. When a step contains a section for both Self-Signed Certificates
and Certificates Signed by a Certificate Authority (includes OracleAS Certificate Authority, Versign, Thawte, etc) be sure to follow the steps in
the appropriate section.
Note: Unless you have changed the default settings this should be the same directory as $INST_TOP/certs which we will use in
subsequent steps to identify this directory. This directory defines the location where private keys and certificate files are stored.
2. Create a new directory with the name j2ee and then change to this directory.
$ mkdir j2ee
$ cd j2ee
3. Determine the values for the following parameters which will be used when you create the keystore for your instance:
Parameter
Value
server
domain
password
ST
4. Create your keystore by entering the following command all on 1 line substituting the appropriate parameters (in bold) for your
instance:
$ keytool -keysize 2048 -genkey -keyalg RSA -sigalg SHA256withRSA -keystore server.jks
-keypass password -storepass password -validity 365 -dname "CN=server.domain, OU=JKS, O=O,
ST=ST, C=C"
3/07/2016 12:52 p. m.
Document 376700.1
12 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
When you receive your signed certificate copy it to this directory ($INST_TOP/certs/j2ee) as jks_server.crt along with the Certificate
Authority's root certificate which should be re-named jks_ca.crt and the Authorities intermediate certificate (if applicable) which should be
renamed jks_intca.crt.
Note: We are naming the certificate jks_server.crt to distinguish it from the Apache server.crt
If you want to create jks_ca.crt and/or jks_intca.crt using your jks_server.crt file you can do so by following the directions in Section 7:
Creating your Certifying Authority's Certificate.
3/07/2016 12:52 p. m.
Document 376700.1
13 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
hvcNAQEBBQADgY0AMIGJAoGBALaNY6QpChZPem7nXF7NJ5tmW1UFNqOgVW37fW4YiJH10yHKMLhB
zx6z9QxuJiNKiNzjckJ4KfnLp8xG58lZlubKPSei7yz1KJxeM8j39NbbIifsPYfqtT/EPdDDGK+B
kg0lK4c09TvxL93y0mFW7IG0PyqB0/ZTnBAcv2Fdyrg
/AgMBAAEwDQYJKoZIhvcNAQEFBQADgYEA
R/EeD4iJXuYV5eQmkp64D/aguNeyGu4qn67tU+iGDjDNtaO1qTPbTiDngD
/H8WpPjmxPcJxszp6z
fcKsFVgNmUC4js5U3DGA8Bcdl1ZGYvP7PUU0wZceHjD+KBB1sdV8KzL94OW41/RPXXUxIW6/UHRP
huFcDlIK2ExiXu7c5vw=
-----END CERTIFICATE----Copy the lines from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE----- as indicated in bold.
Using the text editor of your choice, save these lines as jks_ca.crt.
B. Certificates Signed by a Certificate Authority
This step is not applicable if you are using self-signed certificates - continue with "C. Either Type Certificate"
In Step 3 you copied jks_ca.crt, jks_intca.crt, and jks_server.crt to the $INST_TOP/certs/j2ee directory. Now you will
use the import command to add it to the keystore substituting the appropriate parameters (in bold) for your instance
:
$ keytool -import -alias myca -keystore server.jks -storepass password -file
jks_ca.crt
$ keytool -import -alias myintca -keystore server.jks -storepass password -file
jks_intca.crt
$ keytool -import -keystore server.jks -storepass password -file jks_server.crt
Enter "yes" when prompted with: Trust this certificate? [no]: yes
Note: You may not have an intermediate ca certificate. It will depend on the Certifying Authority and certificate type. If an intermediate
ca certificate has been provided then this will also need to be imported with the root certificate.
We are not specifying an alias when importing jks_server.crt. The default alias "mykey" will be used. (This is because the -dname on the
certificate matches the -dname on the key generated when the keystore was created.)
You can use either of the following commands to see the contents of your keystore. The -list command by
default prints the MD5 fingerprint of a certificate. If the -v option is specified, the certificate is printed in humanreadable format:
$ keytool -list -keystore <keystore> -storepass <password>
$ keytool -list -v -keystore <keystore> -storepass <password>
Step 5 - Add the Keystore CA Certificates to the Apache and OPMN Wallets (conditional)
This step is only necessary if you have used self-signed certificates to create the keystore OR you used different Certifying Authorities for the
keystore and Apache Wallet.
3/07/2016 12:52 p. m.
Document 376700.1
14 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
Non-SSL Value
s_oc4j_secure
false
true
s_ajp_protocol
ajp
ajps
s_forms_tracking_cookies disabled
enabled
s_oc4j_ssl
on
off
<user>
< name>oc4jkeystoreadmin</name>
<display-name>OC4J keystore admin user</display-name>
<guid>7D1943D0AF0411DC8F65CFCE4073EF3D</guid>
<description>E-Business OC4J keystore admin user</description>
< credentials>{903}Gfqv+nvfuUrfiQpcW7XcpptrOknyC0nj< credentials>
</user>
3/07/2016 12:52 p. m.
Document 376700.1
15 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
where password = the password you assigned when you created your keystore. Be sure to include the !.
This will encrypt the password the next time the service is started.
4. Save the file and exit.
Example: <user>
<name>oc4jstore</name>
<display-name>OC4J keystore admin user</display-name>
<guid>7D1943D0AF0411DC8F65CFCE4073EF3D</guid>
<description>E-Business OC4J keystore admin user</description>
<credentials>!password<credentials>
</user>
B. Navigate to the $ORA_CONFIG_HOME/10.1.3/j2ee/oafm/config directory and repeat steps 1-4.
C. Navigate to the $ORA_CONFIG_HOME/10.1.3/j2ee/forms/config directory and repeat steps 1-4.
3/07/2016 12:52 p. m.
Document 376700.1
16 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
3/07/2016 12:52 p. m.
Document 376700.1
17 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
apply the October 2015 CPU (Patch 21845960) to FMW 10.1.3.5 without applying the October 2015 CPU to all components; however,
we recommend that customers apply the latest CPU across all technology stack components and the Oracle E-Business Suite.
Depending on your certificate provider, they may not accept MD5 based certificate requests (CSR) generated by Oracle Wallet Manager
(OWM). For example, VeriSign will now only accept SHA-1 2048 bit based CSRs or higher. Due to a current limitation in both OWM and
orapki, they are incapable of generating anything other than MD5 based CSRs. The workaround is to make use of openssl to generate the
CSR. An example of this process is provided here:
Using the Oracle Wallet Manager:
1) Generate your CSR using the OWM as this will also create the key pair, and save the wallet.
2) Use openssl to extract the private key from the wallet in order to create a CSR for the key(pair) that is in the wallet:
openssl pkcs12 -in ewallet.p12 -nodes -out nonoracle_wallet.pem
At this point openssl will prompt you for the request attributes. Be sure to enter the same data you entered when creating the CSR in OWM.
Do not specify a 'challenge password' as this has been deemed to be insecure by most certifying authorities.
4) Remove the PEM format file:
rm nonoracle_wallet.pem
At this point openssl will prompt you for the request attributes. Be sure to enter the same data you entered when creating the CSR earlier.
Do not specify a 'challenge password' as this has been deemed to be insecure by most certifying authorities.
3) Remove the PEM format file:
rm nonoracle_wallet.pem
3/07/2016 12:52 p. m.
Document 376700.1
18 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
REJECTED
S
e ACCEPTED
r
v
e REQUESTED
r
REQUIRED
REJECTED
ACCEPTED
REQUESTED
REQUIRED
OFF
OFF
OFF
No Connection
OFF
OFF
ON
ON
OFF
ON
ON
ON
No Connection
ON
ON
ON
Oracle has certified Oracle E-Business Suite Release 12 with the server parameter set to REQUIRED - this ensures that all Oracle
E-Business Suite Release 12 TNS network traffic is being encrypted.
Although ANO/ASO supports a number of different encryption algorithms, the supported algorithms are version dependent. For Oracle
E-Business Suite Release 12 certification the the server's preference is set to AES256, AES192, 3DES168.
Appendix A - Using Network Traffic Encryption contains information on Enabling Trace, Verifying ANO is Functioning Correctly, and the Types
of Encryptions Allowed and Supported.
The remainder of this section will help you enable the encryption in each of the different ORACLE_HOMEs in an Oracle E-Business Suite
Release 12 deployment.
Step 1 - Apply CPU Patch 12837860
Ensure the 10.1.2 Oracle Home is at patch level 10.1.2.3 before applying CPU Patch 12837860.
1. Upgrade to Oracle Application Server 10.1.2.3 (as detailed in 'Upgrading OracleAS 10g Forms and Reports in Oracle E-Business Suite
Release 12' My Oracle Support Knowledge Document 437878.1).
2. Apply CPU Patch 12837860 to the 10.1.2.3 Oracle Home (as detailed in "Section 3.1.6 Oracle Fusion Middleware Utilities for Oracle
Databases" in "Patch Set Update and Critical Patch Update October 2011" My Oracle Support Knowledge Document 1346104.1).
Note: No CPU patch needs to be applied to the 10.1.3 Oracle Home used by the Oracle HTTP Server.
Step 2 - Relink FND Executables
All 'FND' executables need to be relinked:
1. Run adadmin
2. When the Main Menu appears select 'Maintain Applications Files Menu' and then select 'Relink Applications Program'.
3. Answer the questions below as follows, in order to select the individual executables for relinking.
3/07/2016 12:52 p. m.
Document 376700.1
19 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
Use the editor of you choice to create the sqlnet_ifile.ora file with the following lines:
###############################################################
#
# sqlnet_ifile.ora for application tier sqlnet encryption with Advanced SSL Configuration
#
###############################################################
SQLNET.ENCRYPTION_TYPES_CLIENT=(AES256, AES192, 3DES168)
SQLNET.ENCRYPTION_CLIENT=REQUIRED
3/07/2016 12:52 p. m.
Document 376700.1
20 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
Non-SSL
Value
s_custom_dbc_params
Note: This step sets the configuration for JDBC client connections and is optional. If the value is not set, and the parameter on the
database tier is set to REQUIRED, the JDBC client connection value will be ACCEPTED (which is the default value). As long as an
encryption or integrity algorithm match is found, the connection will continue without error and the security service will remain enabled.
Update your instance to support SHA-2 signed PKI certificates as noted in Section 9 Signature Algorithm Changes.
Backup the existing wallet and any associated files in your wallet directory.
Copy over your newly issued certificate and save it as server.crt.
If you were also provided updated root and intermediate certificates, copy these over as well to your wallet directory.
Start the Oracle Wallet Manager (OWM) from the 10.1.3 Oracle Home.
Open your existing wallet.
Highlight 'Certificate: [Ready]'
Right-click and select 'Remove User Certificate'.
Acknowledge 'Yes' for removal.
This changes the 'Certificate: [Requested]'
Import any new or updated root and intermediate certificates as 'Trusted Certificates'.
Import the new 'User Certificate' - server.crt
This changes 'Certificate: [Ready]' once again.
Save the updated wallet and exit OWM.
Update your instance to support SHA-2 signed PKI certificates as noted in Section 9 Signature Algorithm Changes.
Backup the existing wallet and any associated files in your wallet directory.
Proceed with Section 3, Step 2 in order to generate a new wallet and CSR.
Copy over your newly issued certificate and save it as server.crt.
If you were also provided updated root and intermediate certificates, copy these over as well to your wallet directory.
3/07/2016 12:52 p. m.
Document 376700.1
21 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
NZDST_CLEAR_PTP
NZDST_CLEAR_PTP
NZDST_CERTIFICATE
## root CA cert
## intermediate CA cert
## server cert
With the wallet now updated with the new certificate, you will also need to update the rest of the SSL/TLS setup by following Section 3, Step
5 starting with the update to the b64InternetCertificate.txt file and then following Step 6 and Step 7 in the same section. The steps in
Section 4 for the database would only be required if the root certificate was updated as part of your newly issued certificate. You only need
to import the root certificate as a 'Trusted Certificates' into the wallet used by the database.
$ cd $TNS_ADMIN/../../trace
$ ls -ltr |
-rw-r--r--rw-r--r--rw-r--r--
Other files are larger, some quite large, and they will contain "encryption is active, using CRYPTOALGORITHM..." messages.
There will be two different algorithms in use, 3DES168 and AES256:
$ cd $TNS_ADMIN/trace
3/07/2016 12:52 p. m.
Document 376700.1
22 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
$ ls -ltr | tail -3
-rw-r--r-- 1 oracle dba 28427064 Sep 24 14:20 svr_11547.trc
-rw-r--r-- 1 oracle dba 70609051 Sep 24 14:20 svr_29270.trc
-rw-r--r-- 1 oracle dba 763726186 Sep 24 14:20 svr_29144.trc
The connections using AES256 are generated by the executables linked to the OCI C libraries (sqlplus, FNDLIBR, RCVOLTM,...)
and the 3DES168 connections originate from the connections via the JDBC interface.
3. Types of Encryptions that are Allowed and Supported
The following section - based on the Oracle Database documentation - describes how the selection of encryption algorithms is
performed on a per-connection basis. You do not have to use this information, you can instead simply use the configuration examples
provided earlier in this document. However, you will have to create your own configuration files if you wish to use different algorithms
or have third party tools that do not support encryption.
3/07/2016 12:52 p. m.
Document 376700.1
23 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
To negotiate whether to turn on encryption or integrity, you can specify four possible values for the Oracle Advanced Security
encryption and integrity configuration parameters. The four values are listed in the order of increasing security. The value
REJECTED provides the minimum amount of security between client and server communications, and the value REQUIRED
provides the maximum amount of network security:
REJECTED
ACCEPTED
REQUESTED
REQUIRED
The default value for each of the parameters is ACCEPTED.
REJECTED
Select this value if you do not elect to enable the security service, even if required by the other side.
In this scenario, this side of the connection specifies that the security service is not permitted. If the other side is set to
REQUIRED, the connection terminates with error message ORA-12650. If the other side is set to REQUESTED, ACCEPTED, or
REJECTED, the connection continues without error and without the security service enabled.
ACCEPTED
Select this value to enable the security service if required or requested by the other side.
In this scenario, this side of the connection does not require the security service, but it is enabled if the other side is set to
REQUIRED or REQUESTED. If the other side is set to REQUIRED or REQUESTED, and an encryption or integrity algorithm
match is found, the connection continues without error and with the security service enabled. If the other side is set to
REQUIRED and no algorithm match is found, the connection terminates with error message ORA-12650.
If the other side is set to REQUESTED and no algorithm match is found, or if the other side is set to ACCEPTED
or REJECTED, the connection continues without error and without the security service enabled.
REQUESTED
Select this value to enable the security service if the other side permits it.
In this scenario, this side of the connection specifies that the security service is desired but not required. The security service
is enabled if the other side specifies ACCEPTED, REQUESTED, or REQUIRED. There must be a matching algorithm available on
the other side otherwise the service is not enabled. If the other side specifies REQUIRED and there is no matching algorithm,
the connection fails.
REQUIRED
Select this value to enable the security service or preclude the connection.
In this scenario, this side of the connection specifies that the security service must be enabled. The connection fails if the
other side specifies REJECTED or if there is no compatible algorithm on the other side.
The following table shows whether the security service is enabled, based on a combination of client and server configuration
parameters. If either the server or client has specified REQUIRED, the lack of a common algorithm causes the connection to
fail. Otherwise, if the service is enabled, lack of a common service algorithm results in the service being disabled.
Client
REJECTED
S
e
r
v
e
r
REJECTED
OFF
OFF
OFF
Connection fails
ACCEPTED
OFF
OFF
ON
ON
REQUESTED
OFF
ON
ON
ON
3/07/2016 12:52 p. m.
Document 376700.1
24 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
REQUIRED
Connection fails
ON
ON
ON
Displaying the encryption options available from the Tools and Database ORACLE_HOME
After setting your environment to either the Tools or Database ORACLE_HOME using the "adapters" command:
$ . $ORACLE_HOME/bin/adapters
This will display a list of the encryption options available for the following:
Change Log
Date
Description
- Added information on FMW requirements to Section 3 for client TLS 1.2 support.
- Removed reference to note 1275428.1, as information is misleading regarding current SHA-2
compatibility.
- Added updates in Section 3 and Section 9 for SHA-2 support of HP Itanium, along with use of the
mkwallet command as an alternative.
- Updated Section 11 to make a note of the recommendation to generally generate a new private key
and CSR for security reasons.
- Added OpenSSL version minimum requirements.
3/07/2016 12:52 p. m.
Document 376700.1
25 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
- Doc Bug 22102576: Updated openssl command in Section 9 for SHA-2 and keytool command in
Section 5, Step 2 for SHA-2.
April 2, 2015
Updated information on SHA-2 compatibility as well as workaround for MD5 based certificate requests.
- Published revised document to include all remaining comments, and all format and grammatical
changes.
May 1, 2009
Processed remarks and added Certificate Provisioning for XML Publisher or Business Intelligence
Publisher.
Nov 3, 2008
Oct 7, 2008
Nov 5, 2007
Oct 4, 2007
Added note that use of the Forms Server Listener with ConnectMode=https is not supported.
Initial creation.
Doc Bug 21957788: Removed reference to rewrite rule for online help as it is no longer needed.
Expanded Section 2 with information on inbound, outbound, and loopback.
Updated Section 3 and Section 9 with information on SHA-2 support.
Added Section 11 for the certificate renewal process.
Added Step 11, Section 3 for disabling SSLv3.
3/07/2016 12:52 p. m.
Document 376700.1
26 de 26
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-stat...
REFERENCES
3/07/2016 12:52 p. m.